<strong>What are your additional responsibilities and obligations as an administrator (Committee member or Local Admin) of your CommunityForge platform?</strong>
Any document attached to an offer, request, content "page", "event", "news", photos stored in photo albums can be accessed by anyone who has knowledge of the specific URL address, for example by making a query via a search engine.
You should be aware that such data is no longer protected by CommunityForge's security mechanisms and is therefore at risk of breach or spread over the Internet.
You should therefore under no circumstances put personal information of your members in these contents, except with the consent of the member.
For the record, on platforms provided by CommunityForge, “documents” content and their attachments are stored on a secure private space not accessible to ordinary visitors.
Each user of the platform can choose to disclose their own personal data, but they must be aware of the consequences of this choice, as specified above.  It is up to you, the site administrators, to explain to your members how to use the platform correctly as explained above, and remind them of the risk incurred if they themselves put personal information in content outside their profile.
This configuration is the result of the majority requests from users of our platforms and Drupal's inherent functions.  If these choices do not suit you, you can exit CommunityForge's basic offering (Local Admin) and increase your responsibility and customization of your platform by requesting User One access or even hosting your platform on a server of your choice and ensuring GDPR compliance yourself.
See: http://helpdesk.communityforge.net/en/proposed_options
You are responsible for the use that you make of your members' personal data extracted from your platform, and you must in no case distribute this data beyond the platform without the authorization of the members concerned, under penalty of violating the regulations and being in non-compliance.
Attention, if you are several to have an access administrator (local admin, committee), it is outlawed to use to several the same account administrator.  The law requires that each action can be identified in such a way that unlawful disclosure of data can be traced. You must therefore delete this joint account and have your own accounts that allow you to identify yourself unambiguously.
Exceeding the number of 5 people for the administration of a platform is not recommended on the GDPR reference documents. As a "local admin", you must ensure that this recommendation is respected.
The GDPR requires all data managers to establish a form that specifically identifies who is responsible for data management in your community. It is your responsibility to prepare this document and to keep it ready to be able to respond to any request made by the competent authorities. CommunityForge offers you a form to easily list this information.
Finally, you have the duty to be able to provide each of your members the information concerning them, recorded on your platform.  Members may, if they so wish, enforce their "right to forget" by deleting their own account as long as their balance is zero or positive.
